Snapshot of North Korea’s DNS data taken from zone transfers • Hacker News Board

Re: Snapshot of North Korea’s DNS data taken from zone transfers

#101

Post by walrus01 » Tue, Sep 20, 2016, 11:21 PM UTC

benedikt wrote: post #19

Slightly related, I ran nmap scans on the known NK internet for a while. The data can be found here: https://github.com/benediktkr/nk-scans

As interesting as this is, I really don't think that IP blocks which are supposedly in North Korea are the limit of what their government/state apparatus has. I would not be surprised at all if significant blocks of IPV4 belonging to the Chinese upstream ISPs just across the border are also in use in locations geographically within North Korea.

Re: Snapshot of North Korea’s DNS data taken from zone transfers

#102

Post by nunez » Wed, Sep 21, 2016, 12:05 AM UTC

EE84M3i wrote: post #77

vmp wrote: post #8

Fascinating, that's the complete zone for the whole country? And it's run on 5 servers? (only 5 different IPs mentioned as far as I can tell)

This is a bit misleading. According to Will Scott, who taught CS in North Korea, there are some 3000-5000 sites on the national intranet, but it is entirely disconnected from the internet at large. So these zones are ones that are intended for consumption by foreigners. Source: http://motherboard.vice.com/read/how-to-teach-computer-scien... (super interesting, suggest reading it)

Holy shit; they are still teaching classful routing (Class A, B, C, D...)

Re: Snapshot of North Korea’s DNS data taken from zone transfers

#103

Post by dprkinaddr » Wed, Sep 21, 2016, 4:00 AM UTC

; > DiG 9.9.5-9+deb8u6-Debian > +tcp @ns2.co.kp axfr 176.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 176.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082900 28800 86400 1209600 86400 176.45.175.in-addr.arpa. 432000 IN NS ns1.kptc.kp. 176.45.175.in-addr.arpa. 432000 IN NS ns2.kptc.kp. #10.176.45.175.in-addr.arpa. 432000 IN PTR smtp.star-co.net.kp. 15.176.45.175.in-addr.arpa. 432000 IN PTR ns1.kptc.kp. 16.176.45.175.in-addr.arpa. 432000 IN PTR ns2.kptc.kp. 61.176.45.175.in-addr.arpa. 432000 IN PTR smtp.star.net.kp. 67.176.45.175.in-addr.arpa. 432000 IN PTR naenara.com.kp. 70.176.45.175.in-addr.arpa. 432000 IN PTR mail.silibank.net.kp. 176.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082900 28800 86400 1209600 86400 ;; Query time: 455 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:54:17 UTC 2016 ;; XFR size: 10 records (messages 1, bytes 317)

; > DiG 9.9.5-9+deb8u6-Debian > +tcp @ns2.co.kp axfr 178.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 178.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082903 28800 86400 1209600 86400 178.45.175.in-addr.arpa. 432000 IN NS ns1.kptc.kp. 178.45.175.in-addr.arpa. 432000 IN NS ns2.kptc.kp. 170.178.45.175.in-addr.arpa. 432000 IN PTR smtp.star.net.kp. 55.178.45.175.in-addr.arpa. 432000 IN PTR smtp.star-co.net.kp. 178.45.175.in-addr.arpa. 432000 IN SOA ns1.kptc.kp. root.kptc.kp. 2013082903 28800 86400 1209600 86400 ;; Query time: 1628 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:56:19 UTC 2016 ;; XFR size: 6 records (messages 1, bytes 223)

; > DiG 9.9.5-9+deb8u6-Debian > +tcp @ns2.co.kp axfr 179.45.175.in-addr.arpa ; (1 server found) ;; global options: +cmd 179.45.175.in-addr.arpa. 432000 IN SOA ns1.star.edu.kp. root.kptc.kp.179.45.175.in-addr.arpa. 2013082900 28800 86400 1209600 86400 179.45.175.in-addr.arpa. 432000 IN NS ns1.star.edu.kp. 69.179.45.175.in-addr.arpa. 432000 IN PTR mail.star.edu.kp. 76.179.45.175.in-addr.arpa. 432000 IN PTR ns1.star.edu.kp. 179.45.175.in-addr.arpa. 432000 IN SOA ns1.star.edu.kp. root.kptc.kp.179.45.175.in-addr.arpa. 2013082900 28800 86400 1209600 86400 ;; Query time: 465 msec ;; SERVER: 175.45.176.16#53(175.45.176.16) ;; WHEN: Wed Sep 21 03:56:25 UTC 2016 ;; XFR size: 5 records (messages 1, bytes 194)

You forgot to dump the PTR records for their IP ranges

Re: Snapshot of North Korea’s DNS data taken from zone transfers

#104

Post by A1kmm » Wed, Sep 21, 2016, 12:53 PM UTC

Looking at the A records tells an even more interesting story:

    (for i in *.zone; do expand $i | grep " A " | cut -c 50-; done) | sort | uniq -c | sort -n
      1 75.45.179.76
     16 75.45.176.15
     16 75.45.176.16
     25 75.45.176.8
     25 75.45.176.9

It looks like all those websites are hosted on only 5 IP addresses. They could be load balancers, but still, that is certainly not many hosts!

Re: Snapshot of North Korea’s DNS data taken from zone transfers

#105

Post by soylentcola » Wed, Sep 21, 2016, 4:18 PM UTC

navbaker wrote: post #65

soylentcola wrote: post #57

Earlier quoted context omitted.

Sure, but while not quite the same level, my voicemail icon is a reel-to-reel tape and lots of "save" icons are floppy disks.

My wife and I occasionally wonder if our one year old will think we're crazy when we talk about "taping" a show.

At my workplace, we route video and audio over Cat5 to specialized PCs with capture cards, running software that records and then streams or uploads to a video content server where people can log into an account and view a list of presentations on a content management application.

They still email to ask if I can tape their upcoming event.